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Internet Open Trading Protocol 
Version 2 Requirements 
Status of this Memo 
This memo provides information for the Internet community. It does 
not specify an Internet standard of any kind. Distribution of this 
memo is unlimited. 
Copyright Notice 
Copyright (C) The Internet Society (2002). All Rights Reserved. 
Abstract 
This document gives requirements for the Internet Open Trading 
Protocol (IOTP) Version 2 by describing design principles and scope 


and dividing features into those which will, may, or will not be 
included. 


Version 2 of the IOTP will extend the interoperable framework for 
Internet commerce capabilities of Version 1 while replacing the XML 
messaging and digital signature part of IOTP vl with standards based 
mechanisms. 
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1. Introduction 


Version 2 of the Internet Open Trading Protocol (IOTP) will extend 
the interoperable framework for Internet commerce capabilities of 
Version 1 [RFC 2801] as described in Section 3 below. In addition, 
it will replace the ad hoc XML messaging and digital signature [RFC 
2802] parts of IOTP vl with standards based mechanisms [RFC 3275]. 


This document gives requirements for the Internet Open Trading 

Protocol (IOTP) Version 2 by describing design principles and scope 

and dividing features into those which will, may, or will not be 

included. 

2. Design Principles and Scope 

1. The specification must describe the syntax and processing 
necessary for an extension of the interoperable framework for 
Internet commerce described in IOTP V1.0 [RFC 2801]. 

2. Keep changes to IOTP V1.0 to a minimum. 

3. Maintain all existing functionality of IOTP V1.0. 


4. Test all XML DTDs and/or Schemas and XML examples in the 
specification to insure that they are well-formed. 


5. Create usage/implementation guidance information, probably as a 
separate document. 


6. It should be designed to work well with other protocols such as 
ECML [RFC 3106]. 


7. IOTP Version 2 should be developed as part of the broader Web 
design philosophy of decentralization, URIs, Web data, and 
modularity /layering / extensibility. [Berners-Lee, WebData] In 
this context, this standard should take advantage of existing 
provider (and infrastructure) primitives. 


3. Requirements 
IOTP Version 2 will include the following: 
1. Be a superset of IOTP Version 1. 
2. Provide for the Dynamic Definition of Trading Sequences. I.E., 


transactions will not be limited, as with vl, to a single payment 
and a single delivery with delivery occurring after payment. 


Eastlake Informational [Page 2] 


RFC 3354 IOTP V2 Requirements August 2002 


6. 


Instead, it will be possible to propose an arbitrary sequence of 
transaction steps. 


Include specification of an Offer Request Block. 
Support Improved Problem Resolution (extend to cover presentation 
of signed receipt to customer support party, better defined 


Customer Care role, etc.). 


Add provisions to indicate and handle a payment protocol not 
tunneled through IOTP. 


Add support for server based wallets. 


The following may be include in IOTP v2: 


aise 


Support Repeated/ongoing payments. For example, a means to 
specify that a customer approval covers not only the instant 
purchase but also some limited number of future purchase with some 
total or per purchase spending limit. 


Enhanced Server to Server messages. For example, a means for a 
Delivery Handler to inform a Payment Handler that goods have 
actually shipped, which may be a pre-condition for making a charge 
against a credit card. 


Include the ability to add both fields and attributes to existing 
trading blocks in addition to the present ability to add entirely 
new trading blocks. 


The following are out of scope for IOTP version 2: 


1. 


Legal or regulatory issues surrounding the implementation of the 
protocol or information systems using it. 


Design of an XML Messaging Layer. Instead, whatever is or appears 
most likely to become the standard XML messaging layer will be 
used. This includes a standard enveloping, addressing, and error 
reporting framework. 


Design of XML Digital Signatures. Instead, the existing standard 
[RFC 3275] will be used. 


Eastlake Informational [Page 3] 


RFC 3354 IOTP V2 Requirements August 2002 


4. Security Considerations 


As provided above, IOTP v2 will provide optional authentication via 
standards based XML Digital Signatures [RFC 3275]; however, neither 
IOTP vl nor v2 provide a confidentiality mechanism. Both require the 
use of secure channels such as those provided by TLS [RFC 2246] or 
IPSEC for confidentiality and depend on the security mechanisms of 
any payment system used in conjunction with them to secure payments. 
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Full Copyright Statement 
Copyright (C) The Internet Society (2002). All Rights Reserved. 


This document and translations of it may be copied and furnished to 
others, and derivative works that comment on or otherwise explain it 
or assist in its implementation may be prepared, copied, published 
and distributed, in whole or in part, without restriction of any 
kind, provided that the above copyright notice and this paragraph are 
included on all such copies and derivative works. However, this 
document itself may not be modified in any way, such as by removing 
the copyright notice or references to the Internet Society or other 
Internet organizations, except as needed for the purpose of 
developing Internet standards in which case the procedures for 
copyrights defined in the Internet Standards process must be 
followed, or as required to translate it into languages other than 
English. 


The limited permissions granted above are perpetual and will not be 
revoked by the Internet Society or its successors or assigns. 


This document and the information contained herein is provided on an 
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING 
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING 
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION 
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF 
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 
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